User Device Tracker Reports for Rouge Devices Found

I think the word you're looking for is Rogue.

I think the word you're looking for is Rogue.

Yes, please!

The MAIN goal in our purchase of UDT is to be able to get as much information about ROGUE devices. In this report, please include IP address, name of device (from DNS and/or IPAM: hostname) as well as name of switch and port. This will certainly be more useful than the current display of rogue devices in main UDT page. Thanks, Luiz.

Agreed, when I was doing some UDT work I noticed how rogue device alerts also *don't* go away ever until you whitelist a device. Which is a bit of a concern. Having it tossed into reporting would certainly be better.

It's a home made SWQL report but it's doing the job I need it to do when I put it into a custom report. 'cp.cp1_site' is a custom property we have so ignore that if you don't have any custom properties to worry about. This is a rolling monthly Rogue device list which detects a new IP and MAC combination. So an entirely new device from our IP and MAC white lists. You can probably tweak it to get all new rogue IPs and MACs separately. So here you go, hope it helps if you're still interested.

SELECT DISTINCT ip.IPAddress, rma.MACAddress, rma.LastUpdate, mv.MACVendor, rma.FirstSeen, up.Name, n.Caption, n.DNS, cp.cp1_site FROM Orion.UDT.IPAddress ip JOIN Orion.UDT.RogueMACAlert rma ON ip.EndpointID = rma.EndpointID JOIN Orion.UDT.MACAddressInfo mv ON rma.EndpointID = mv.EndpointID JOIN Orion.UDT.RogueIPAlert ipa ON ip.IPAddress = ipa.IPAddress JOIN Orion.UDT.Port up ON up.PortID = rma.PortID JOIN Orion.NodesCustomProperties cp ON up.NodeID = cp.NodeID JOIN Orion.Nodes n ON up.NodeID = n.NodeID WHERE (rma.Rogue = TRUE AND ipa.Rogue = TRUE) AND ((rma.FirstSeen > (ADDDATE('month',-1,GETDATE()))) AND rma.FirstSeen < GETDATE()) ORDER BY rma.FirstSeen ASC